CVE-2026-48027: Nx Console Extension Supply-Chain Credential Stealer (KEV)
CVE-2026-48027 is a software supply-chain compromise of the Nx Console editor extension: a malicious build, version 18.95.0, was briefly published to the Visual Studio Marketplace and OpenVSX on 2026-05-19 and silently harvested developer credentials — npm, GitHub, AWS, Vault and 1Password secrets — from any machine that installed or auto-updated to it, and CISA added it to the KEV catalog citing known use in further attacks.
Vulnerability summary
| Vulnerability ID | CVE-2026-48027 |
|---|---|
| CVSS score | 9.8 |
| EPSS score | 0.0185 |
| CISA KEV | Yes — in the Known Exploited Vulnerabilities catalog |
| Source | NVD |
| Published | 2026-05-27T17:16:41.787 |
Affected components
| Component | CPE | Version range |
|---|---|---|
| Nx Console (Visual Studio Code / OpenVSX extension) | cpe:2.3:a:nx:nx_console:18.95.0:*:*:*:*:visual_studio_code:*:* | Version 18.95.0 only, live on the Visual Studio Marketplace 2026-05-19 12:30-12:47/12:48 UTC (~18 minutes) and on OpenVSX 12:33-13:09 UTC (~36 minutes); fixed by upgrading to 18.100.0 or later |
What this means
CVE-2026-48027 (CWE-506, embedded malicious code) affects Nx Console, the official editor extension for the Nx and Lerna monorepo build tools. NVD's description states: "On 19 May 2026, a malicious version of Nx Console, 18.95.0, was published at 12:30 PM UTC and removed soon after at 12:48 PM UTC, leaving it available for ~18 minutes in Visual Studio Marketplace. For OpenVSX, the problem was detected later, and the compromised version was available from 12:33 UTC to 13:09 UTC (~36 minutes). Version 18.100.0 of Nx Console is not compromised and users may remediate by upgrading to that version" (NVD).
NVD's own analysis gives this a CVSS v3.1 base score of 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H — the maintainer's GitHub Security Advisory separately scored it CVSS v4.0 9.3 (NVD).
The maintainers' GitHub Security Advisory GHSA-c9j4-9m59-847w details what the compromised extension actually did: it fetched an obfuscated payload that targeted credentials across multiple systems — HashiCorp Vault token files and authentication mechanisms, npm registry tokens and OIDC exchanges, AWS instance-metadata-service and Secrets Manager/Web Identity tokens, GitHub personal access tokens in ghp_/gho_/ghs_ formats plus Actions secrets and process memory contents, 1Password CLI vault data when a session was active, and filesystem secrets such as private keys and cloud-provider connection strings. Harvested data was exfiltrated via HTTPS, the GitHub API and DNS, and on Linux the payload additionally attempted to inject itself into /etc/sudoers for persistence. The advisory's remediation steps instruct affected users to update to 18.100.0 or later, kill any __DAEMONIZED and cat.py processes left behind, delete listed persistence artifacts on macOS/Linux/Windows, and rotate all credentials, tokens and SSH keys while auditing access logs (GitHub Security Advisory GHSA-c9j4-9m59-847w).
CISA added CVE-2026-48027 to the Known Exploited Vulnerabilities (KEV) catalog on 2026-05-27, with a required-action due date of 2026-06-10, and — unusually for a disclosure this recent — records known ransomware/campaign use as "Known," reflecting that harvested secrets were used in follow-on compromise rather than the extension compromise being the only observed activity. Catalog version 2026.10.28, 1,762 entries, confirmed live this run (CISA KEV).
As of 2026-10-29, FIRST scores the probability of exploitation at 0.0185 (79.054th percentile) — the exposure window has closed, but the EPSS percentile still reflects documented real-world credential theft and reuse during the live window (FIRST EPSS).
Anyone who had Nx Console 18.95.0 installed between 2026-05-19 12:30 and 13:09 UTC should treat every credential reachable from that machine (npm, GitHub, AWS, Vault, 1Password, SSH, private keys) as compromised: rotate them immediately, update to 18.100.0 or later, check for the documented persistence artifacts, and audit cloud/CI access logs for unauthorized use during and after that window.
Evidence
- Malicious Nx Console 18.95.0 was published 2026-05-19 and live on VS Marketplace ~18 minutes (12:30-12:48 UTC) and OpenVSX ~36 minutes (12:33-13:09 UTC); fixed by upgrading to 18.100.0. — NVD
- NVD Primary CVSS v3.1 base score is 9.8 (critical), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; GitHub's own advisory separately scored it CVSS v4.0 9.3. — NVD
- The payload harvested Vault, npm, AWS, GitHub, 1Password and filesystem credentials, exfiltrated via HTTPS/GitHub API/DNS, and attempted sudoers persistence on Linux; remediation requires updating, killing malicious processes, deleting persistence artifacts, and rotating all credentials. — GitHub Security Advisory GHSA-c9j4-9m59-847w
- Added to the CISA KEV catalog on 2026-05-27, required-action due date 2026-06-10, known ransomware/campaign use recorded as "Known." Catalog version 2026.10.28, 1,762 entries, confirmed live this run. — CISA KEV
- EPSS score is 0.0185 (79.054th percentile) as of 2026-10-29. — FIRST EPSS